| sootmark-pe cargo | 0.1.0 | none | none | Windows Portable Executable (PE) metadata for forensics: compile time, type, sections, imports, exports, import hash, version information, PDB path, resource… | 20 | 9d ago |
| sootmark-intake cargo | 0.13.0 | none | none | Evidence intake: read directories, zips, disk images (E01, VHDX, raw) and AD1 logical images, recognise KAPE and Velociraptor collections, detect which parser… | 332 | 9d ago |
| sootmark-msiecf cargo | 0.1.0 | none | none | Internet Explorer 4 to 9 cache and history files (index.dat) for forensics: cached URLs with their files and HTTP headers, visited pages, redirects, leaked… | 20 | 9d ago |
| sootmark-disk cargo | 0.5.0 | none | none | Disk images for forensic intake: raw and split raw images, GPT and MBR partitions, NTFS (alternate data streams, compression), FAT and exFAT file listing with… | 505 | 9d ago |
| sootmark-onedrive cargo | 0.1.0 | none | none | OneDrive and SkyDrive logs for forensics: the sync engine's binary logs (.odl, .odlgz) with each record's time, source file, function and parameters… | 20 | 9d ago |
| sootmark-notifications cargo | 0.1.0 | none | none | Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps… | 20 | 9d ago |
| sootmark-filehistory cargo | 0.1.0 | none | none | Windows File History catalogs (Catalog1.edb, Catalog2.edb) for forensics: every file and folder backed up, with its path, times, attributes and USN, and the… | 20 | 9d ago |
| sootmark-evt cargo | 0.1.0 | none | none | Windows NT to XP and Server 2003 event logs (.evt) for forensics: every record in log order, those recovered from the free space, with times, event ids,… | 20 | 9d ago |
| winreg-core cargo | 0.2.1 | none | none | Core Windows Registry hive parser | 6.8K | 9d ago |
| sootmark-mlocate cargo | 0.1.0 | none | none | The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last… | 21 | 9d ago |
| sootmark-cups cargo | 0.1.0 | none | none | CUPS print jobs for forensics: the IPP control files in the spool (/var/spool/cups, macOS and Linux): who printed what, from which application and host, to… | 21 | 9d ago |
| sootmark-vss cargo | 0.1.0 | none | none | Windows Volume Shadow Copies (VSS) in an NTFS volume: every snapshot with its times, GUIDs and machine names, and each snapshot's view of the volume as a Read… | 19 | 9d ago |
| sootmark-ntfslog cargo | 0.1.0 | none | none | NTFS transaction journal ($LogFile): restart areas, every log record with its redo and undo operations, and the file names and timestamps they carry. | 23 | 9d ago |
| sootmark-fwlogs cargo | 0.1.0 | none | none | Firewall logs for forensics: Palo Alto PAN-OS (syslog and CSV export), Fortinet FortiGate (key=value and CSV), Cisco ASA syslog, read into connections,… | 24 | 9d ago |
| sootmark-esxi cargo | 0.1.0 | none | none | VMware ESXi for forensics: the host configuration (esx.conf), the VM inventory (vmInventory.xml), VM settings (.vmx) and snapshots (.vmsd): what ran on the… | 21 | 9d ago |
| sootmark-browser cargo | 0.7.0 | none | none | Browser history for forensics: visits and downloads from Chromium-family History databases (Chrome, Edge, Brave, Opera, Vivaldi), Firefox places.sqlite and… | 136 | 9d ago |
| sootmark-bsm cargo | 0.1.0 | none | none | macOS and FreeBSD audit trails (BSM, OpenBSM) for forensics: every audited event with its subject, paths, arguments, sockets and return, read without libbsm. | 43 | 9d ago |
| sootmark-eventtranscript cargo | 0.1.1 | none | none | Windows diagnostic data (EventTranscript.db) for forensics: telemetry events with their time, program, producer, tags and payload: browsing, app use, installs,… | 45 | 9d ago |
| sootmark-model cargo | 0.2.4 | none | none | The Sootmark record and event model, and the contract parser adapters implement. | 457 | 9d ago |
| sootmark-containers cargo | 0.1.1 | none | none | Container forensics: Docker container configurations, json-file logs and image layers, and Kubernetes CRI container logs. | 51 | 9d ago |
| sootmark-audit cargo | 0.1.1 | none | none | Linux audit logs (auditd's audit.log, raw or enriched): records gathered into events, values decoded, command lines, system calls and socket addresses, and the… | 151 | 9d ago |
| sootmark-avlogs cargo | 0.1.1 | none | none | Antivirus logs for forensics: McAfee access protection, Symantec scan logs, Sophos SAV.txt, Trend Micro virus detection and web reputation, read into… | 73 | 9d ago |
| sootmark-cloudlogs cargo | 0.3.0 | none | none | Cloud and SaaS audit logs for forensics: AWS CloudTrail, the Microsoft 365 unified audit log, Entra ID sign-ins and audits, Azure activity, Google Cloud audit… | 122 | 9d ago |
| sootmark-weblogs cargo | 0.3.0 | none | none | Web server access logs for forensics: Apache and nginx (common, combined, virtual host), Jira, Confluence and Bitbucket, AWS load balancers (ELB) and Azure… | 69 | 9d ago |
| sootmark-utmp cargo | 0.4.1 | none | none | Linux login records (utmp, wtmp, btmp, lastlog, wtmpdb, lastlog2): glibc's struct utmp and struct lastlog in their 32- and 64-bit-time layouts, either byte… | 261 | 9d ago |
| sootmark-tasks cargo | 0.1.0 | none | none | Windows scheduled tasks for forensics: the task XML files of System32\Tasks and the .job files of older Windows (what runs, as whom, when, hidden or not). | 76 | 9d ago |
| sootmark-shell cargo | 0.3.0 | none | none | Windows shell items, LNK files (MS-SHLLINK), jump lists and compound files (MS-CFB), from the public documentation. | 409 | 9d ago |
| sootmark-registry cargo | 0.10.0 | none | none | Windows registry hive (regf) parser: keys, values, big data, subkey indexes; ShimCache, UserAssist, ShellBags, Amcache, BAM, USB devices, RDP history, MRU… | 477 | 9d ago |
| sootmark-defender cargo | 0.2.0 | none | none | Microsoft Defender for forensics: its detection history files (what was detected, where, when, by which process, for which user, and the file's SHA-256) and… | 82 | 9d ago |
| sootmark-ual cargo | 0.1.0 | none | none | Windows Server User Access Logging (UAL, the Sum folder's .mdb databases) for forensics: which accounts and addresses used which server role, when, and how… | 98 | 9d ago |
